Agent skill · security · sickn33
broken-authentication
Identify and exploit authentication and session management vulnerabilities in web applications. Broken authentication consistently ranks in the OWASP Top 10 and can lead to account takeover, identity theft, and unauthorized access to sensitive systems.
Why this skill is useful
Adds specific testing methodologies and executable scripts for identifying broken authentication vulnerabilities that are not commonly known.
What it needs
Requires burp-suite, hydra installed locally. About 8k tokens when loaded. Last updated 2026-08-07. 44,571 stars on the source repository.
What this skill does
⚠️ AUTHORIZED USE ONLY This skill is for educational purposes or authorized security assessments only. You must have explicit, written permission from the system owner before using this tool. Misuse of this tool is illegal and strictly prohibited. Mandatory confirmation gate Before running any command that probes, exploits, changes, persists on, extracts data from, or attempts credential access against a target: 1. Ask the user to state the exact target URL, IP, account, or resource. 2. Ask the user to confirm written authorization and the permitted scope. 3. Show the exact command(s) and explain their expected effect. 4. Wait for explicit confirmation in the current conversation. Without that confirmation, remain read-only and provide defensive guidance only. Prefer a sandbox, disposable VM, or controlled lab. Broken Authentication Testing Purpose Identify and exploit authentication and session management vulnerabilities in web applications. Broken authentication consistently ranks in the OWASP Top 10 and can lead to account takeover, identity theft, and unauthorized access to sensitive systems. This skill covers testing methodologies for password policies, session handling, multi-factor authentication, and credential management. Prerequisites Required Knowledge HTTP protocol and session mechanisms Authentication types (SFA, 2FA, MFA) Cookie and token handling Common authentication frameworks Required Tools Burp Suite Professional or Community Hydra or similar brute-force tools Custom wordlists for credential testing Browser developer tools Required Access Target application URL Test account credentials Written authorization for testing Outputs and Deliverables 1. Authentication Assessment Report - Document all identified vulnerabilities 2. Credential Testing Results - Brute-force and dictionary attack outcomes 3. Session Security Analysis - Token randomness and timeout evaluation 4. …
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills sickn33/broken-authentication--0c4d75